6

A seemingly simple question, but valid nonetheless.

What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI.

Thanks

1

That depends on how your web server reacts when receiving a HTTPS request without SNI. (If you want to test it, you can simulate a non-SNI browser with openssl. Basic HTTP protocol knowledge required.)

With IIS 10, the following happens:

  • If there is a "default SSL site" (a site bound to port 443 without a host name) configured, the non-SNI client will see:

    • the certificate of the default (wrong) SSL site (usually resulting in a certificate warning, unless you configured your default SSL site certificate to include SANs for all sites hosted at your IP address) and
    • the content of the requested (correct) site (after the user dismissed the certificate warning).

    This makes perfect sense:

    1. The SSL handshake happens before the HTTP request can be transmitted. Thus, without SNI support from the browser, the server has no option but to return the default SSL site certificate.
    2. After the SSL connection has been established (using the "wrong" certificate), the server receives the HTTP request, reads the requested host name via the Host: header and returns the correct content.
  • If there is no "default SSL site" configured, the connection will be closed.

(Source: Just tested it with an old Windows XP IE8 virtual machine.)

| improve this answer | |
1

It will probably connect to the default SSL virtual host. In other words, the same site you'd see if you connect using the IP: https://1.2.3.4/

| improve this answer | |
  • I would still love a conclusive answer if anyone has one! – PUncle Oct 6 '13 at 10:38
1

It won't be able to load the website, that's for sure. Which is why no large sites will move to SNI-hosted HTTPS sites anytime soon. IE6 and IE7 in XP appear to be the largest old browsers that don't support SNI.

If you can get a hold of a non-SNI supporting browsers, you can see what happens by going to https://alice.sni.velox.ch/

It also appears to matter which server software you are using. With Apache, browsers without SNI support will just get the first configured website (and a hostname mismatch warning probably).

| improve this answer | |
  • Is there a different sni enabled website that we can use for testing? Looks like https://alice.sni.velox.ch/ is no longer working – kuchi May 30 at 4:40
0

I just tested it using IE 4.0 running on Windows NT 4 Workstation. My website, hosted at http://www.nosupportlinuxhosting.com/, loads perfectly. I'm not sure if their hosting meets the criteria above, but their "Limiations" page suggests that is the case. I'm a bit surprised the page loaded.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.